Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

Click to expand...

to be correct, the boot1 is not read only but the hash for boot1 is. Its to tell the system that boot1 is valid. This hash is stored in a one time programable area at manufacture.

So
Boot0 -> one time programed at manufacture
Boot1 -> reprogram possible BUT the hash is stored permaned, so no reprogramming possible at last.
Boot2 -> reprogram possible. But valid only with bugged Boot1 due to a compare bug of the validation of Boot2. This Bug let the Boot1 think the Boot2 is valid.

Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

Click to expand...

not completely correct. boot1 is writable too but it's sha1 hash is stored in a unwritable rom in starlet.